MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 79b504735990c58ece2e01c3cf95573f2331b158908827f04a8be9d4556c01ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 20
| SHA256 hash: | 79b504735990c58ece2e01c3cf95573f2331b158908827f04a8be9d4556c01ac |
|---|---|
| SHA3-384 hash: | 38d51977342692dbd508038af0147126e9d9841e74c4f23932ab1a28b88bcc292ec8abc35e661960e42254efb5fc8126 |
| SHA1 hash: | 718268283e36b9825c6f5ee5fe289654cee93df7 |
| MD5 hash: | 041c5cada8a17104a2b2a93c58510a11 |
| humanhash: | echo-bacon-don-item |
| File name: | 79b504735990c58ece2e01c3cf95573f2331b158908827f04a8be9d4556c01ac |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'057'280 bytes |
| First seen: | 2026-06-08 08:36:08 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'012 x Formbook, 12'352 x SnakeKeylogger) |
| ssdeep | 24576:q4TS1m6v5J36j/pkIMN7YD9gVP6ctLsaRc8NDIvjt:q44m6v7SyIMNC9q5LIIIvx |
| Threatray | 3'739 similar samples on MalwareBazaar |
| TLSH | T106250254331ACA02D9E65FB45920D2B917788E849521E303CFF6BDFFFC3A35529492A2 |
| TrID | 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  adrian__luca |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
65
Origin country :
HUVendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Malware family:
agenttesla
ID:
1
File name:
message__c27132dea9a8f3f7119e19747f8fc19f_tlsatmex_com_.eml
Verdict:
Malicious activity
Analysis date:
2026-05-25 22:02:48 UTC
Tags:
attachments attc-unc susp-attachments arch-exec stealer ultravnc rmm-tool agenttesla exfiltration ftp
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Verdict:
Malicious
Score:
94.1%
Tags:
virus micro lien msil
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching a service
Changing a file
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-25T16:18:00Z UTC
Last seen:
2026-06-08T21:17:00Z UTC
Hits:
~1000
Malware family:
Agent Tesla
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Detection:
agenttesla
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Status:
Malicious
First seen:
2026-05-25 19:27:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
24 of 36 (66.67%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 3'729 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection discovery keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Family: AgentTesla
Unpacked files
SH256 hash:
79b504735990c58ece2e01c3cf95573f2331b158908827f04a8be9d4556c01ac
MD5 hash:
041c5cada8a17104a2b2a93c58510a11
SHA1 hash:
718268283e36b9825c6f5ee5fe289654cee93df7
SH256 hash:
5caf5819689dfbbfd414a20c91e53cd4732b999c25f6421f096acb0842bf05b3
MD5 hash:
18bec5fccd934ec156683ee0c31efc26
SHA1 hash:
2725d0c08afb567b2e2e269ffa9e56c6114d698b
SH256 hash:
72cbf3dda9b5053ad59c8922dd75c934dbaffa8c4949aaa3a15e46c476daabc3
MD5 hash:
73e8bb323bf6962700ba49eb042216c7
SHA1 hash:
36e6fcf33a08d12240586b56b158e824f2d09d58
Detections:
win_agent_tesla_g2
triage_agenttesla_infostealer
SH256 hash:
9f0318214a856b7be7a65b262d3d085be7d070bad7fe05483866245eb2255cd4
MD5 hash:
1588c1fccc2c56ab0b9ea0a3c6981f6b
SHA1 hash:
8c9fc26a8ea44e39a0655ad307d2c126d3a95492
Malware family:
AgentTesla
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTeslaV2 |
|---|---|
| Author: | ditekshen |
| Description: | AgenetTesla Type 2 Keylogger payload |
| Rule name: | AgentTeslaV5 |
|---|---|
| Author: | ClaudioWayne |
| Description: | AgentTeslaV5 infostealer payload |
| Rule name: | Agenttesla_type2 |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Agenttesla in memory |
| Reference: | internal research |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | INDICATOR_EXE_Packed_GEN01 |
|---|---|
| Author: | ditekSHen |
| Description: | Detect packed .NET executables. Mostly AgentTeslaV4. |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many email and collaboration clients. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many file transfer clients. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing Windows vault credential objects. Observed in infostealers |
| Rule name: | malware_Agenttesla_type2 |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Agenttesla in memory |
| Reference: | internal research |
| Rule name: | MALWARE_Win_AgentTeslaV2 |
|---|---|
| Author: | ditekSHen |
| Description: | AgenetTesla Type 2 Keylogger payload |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
| Rule name: | Windows_Generic_Threat_808f680e |
|---|---|
| Author: | Elastic Security |
| Rule name: | Windows_Trojan_AgentTesla_ebf431a8 |
|---|---|
| Author: | Elastic Security |
| Reference: | https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.